{
 "id": "WPSEC-2026-0965",
 "url": "https://wpsec.com/vuln/WPSEC-2026-0965/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-0965/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-0965/index.md",
 "title": "TranslatePress – Translate Multilingual sites with AI Translation <= 3.3.7 - Unauthenticated Stored Cross-Site Scripting via #TRPLINKPROCESSED Marker in URLs",
 "description": "The TranslatePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the internal #TRPLINKPROCESSED link marker in all versions up to, and including, 3.3.7. This is due to the plugin removing the marker from link href, form action and link element URLs after WordPress's and the plugin's own URL scheme checks have already run, without checking the result again, so a marker placed inside a link URL can hide a javascript: URL from those checks. This makes it possible for unauthenticated attackers to inject arbitrary web scripts through links in comments that execute when a user views the translated version of an injected page and clicks the link.",
 "plugin": {
  "slug": "translatepress-multilingual",
  "name": "TranslatePress – Translate Multilingual sites with AI Translation",
  "full_name": "TranslatePress – Translate Multilingual sites with AI Translation",
  "wordpress_org": "https://wordpress.org/plugins/translatepress-multilingual/",
  "advisories_url": "https://wpsec.com/vuln/plugin/translatepress-multilingual/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/translatepress-multilingual"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 7.2,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
  "severity": "High"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "3.3.8",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 3.3.8"
  ]
 },
 "introduced_in": null,
 "fixed_in": "3.3.8",
 "remediation": "Update to 3.3.8 or later.",
 "fix_released": "2026-10-13T15:00:57+00:00",
 "published": "2026-10-14T20:43:57+00:00",
 "updated": "2026-10-14T19:51:14.915659+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-0965/",
  "https://plugins.svn.wordpress.org/translatepress-multilingual/tags/3.3.8/",
  "https://wordpress.org/plugins/translatepress-multilingual/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/translatepress-multilingual",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "High",
  "affected_versions": "High",
  "as_of": "2026-10-14"
 }
}